kamsoft.exe

Avast Free Antivirus / Premium Security
1

Hi,
My comp was infected with one trojan/malwares/backdoor and avast was not able to remove it although, time and again, would detect it.
The file is kamsoft.exe and it usually makes an entry in the startup. And you may have an autorun.inf file in every drive, even removable hard drive / usb drives.

I tried scanning the entire computer but was not able to remove it.
The symptoms of this infection -

  1. kamsoft.exe in startup
  2. files like e.cmd in C:, ckvo.exe and others
  3. No access to “regedit”
  4. autorun.inf file in every drive
  5. Windows does not show hidden files
  6. All drives, C:, D:\ etc will give options to “Open with” when double clicked.

I was able to remove the file manually.
Post, if any one of you have removed using any avast or any anti-virus.
Thanks.

2

Try to run Superantispyware: http://www.superantispyware.com/ and Malwarebytes Antimalware: http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe possibly in safe mode.
They are very good programs at removing new nasty threats and they have helped me in the past to remove xp antivirus 2008

3

these files should be detected as Win32:Kavos [trj] and are protected by klif.sys rootkit… you should try a boot-time scan to remove the infection… btw: was also the klif.sys file found by the antirootkit module?

4

you can also remove it with COMBOFIX

5

But klif.sys is standard name for driver from Kaspersky antivirus. Are there real rootkits with this name too?

6

yes… this http://www.prevx.com/filenames/X289967154020299796-X1/KXVO.EXE.html e.g. is a variant of Kavo infection which drops a rootkit named klif.sys…